sodinokibi | b1edd39601d0a954c1db219ea86a789870b7b90f8ef5f4789ac74620aa2fe9ed | Triage

Sharing

General

Target

b1edd39601d0a954c1db219ea86a789870b7b90f8ef5f4789ac74620aa2fe9ed
Size

184KB
Sample

200819-h8ryvkct8s
MD5

852af0d8bd9ca12dd679262ec7aff308
SHA1

d5c88fd7a87ad54768428a9d90cf2bd3ae844cdc
SHA256

b1edd39601d0a954c1db219ea86a789870b7b90f8ef5f4789ac74620aa2fe9ed
SHA512

88784f37ef6179100b6537c14b24a5fdedc208be7aa3b43396092fcbf381f64e70605bd1a50aa155585ef17aeb2e380a8ff6b540afa6459da33353452c5e12e9

Score

10^/10

sodinokibi persistence spyware stealer

Malware Config

Targets

- Target
  
  b1edd39601d0a954c1db219ea86a789870b7b90f8ef5f4789ac74620aa2fe9ed
- Size
  
  184KB
- MD5
  
  852af0d8bd9ca12dd679262ec7aff308
- SHA1
  
  d5c88fd7a87ad54768428a9d90cf2bd3ae844cdc
- SHA256
  
  b1edd39601d0a954c1db219ea86a789870b7b90f8ef5f4789ac74620aa2fe9ed
- SHA512
  
  88784f37ef6179100b6537c14b24a5fdedc208be7aa3b43396092fcbf381f64e70605bd1a50aa155585ef17aeb2e380a8ff6b540afa6459da33353452c5e12e9
Score

10^/10

persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer